SCS-C02 Threat Detection and Incident Response Practice Test 13 — 15 Questions

Question 1

A company uses AWS Organizations with multiple accounts. The security team wants to centrally collect and analyze VPC Flow Logs from all accounts. The team has set up a central logging account with an S3 bucket that has a bucket policy allowing cross-account writes. However, VPC Flow Logs from member accounts are not appearing. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VPC Flow Logs cannot be published directly to an S3 bucket in a different account. The logs must be published to a bucket in the same account as the VPC, and then replicated to the central account.. VPC Flow Logs cannot be published directly to an S3 bucket in a different AWS account. The destination S3 bucket must reside in the same account as the VPC from which the logs are generated. To centralize logs, you must first publish them to a bucket in the same account as the VPC, then use S3 cross-region replication or a similar mechanism to copy them to the central logging account. This is a fundamental limitation of the VPC Flow Logs service.

Answer

AWS CloudTrail is not enabled in the member accounts.

Answer

The VPC Flow Logs must be delivered to CloudWatch Logs first, then exported to S3.

Answer

The S3 bucket policy does not allow the s3:PutObject action for the member accounts.

Question 2

A security engineer is configuring Amazon GuardDuty in a multi-account environment using AWS Organizations. The engineer wants to designate a delegated administrator account to manage GuardDuty for all member accounts. Which AWS service must be used to enable GuardDuty for all accounts?

Accepted Answer

AWS Organizations. AWS Organizations is the foundational service required to designate a delegated administrator for Amazon GuardDuty in a multi-account environment. GuardDuty integrates directly with Organizations to allow a management account to enable GuardDuty for all member accounts and delegate administration to a specified account, which then manages threat detection across the organization without needing additional services.

Answer

AWS CloudFormation StackSets

Answer

AWS Control Tower

Answer

AWS Config

Question 3

A security engineer notices suspicious API calls from an EC2 instance that has an IAM role attached. The engineer wants to quickly determine if the instance's credentials have been compromised and are being used from an external IP address. What is the most efficient way to detect this?

Accepted Answer

Enable Amazon GuardDuty and look for the finding type 'UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration'.. Amazon GuardDuty's finding type 'UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration' is specifically designed to detect when EC2 instance credentials (from an IAM role) are being used from an external IP address. GuardDuty analyzes CloudTrail management events, VPC Flow Logs, and DNS logs to identify anomalous API calls where the source IP is outside the VPC, indicating credential exfiltration. This is the most efficient method as it provides a pre-built, automated detection without manual log analysis.

Answer

Check VPC Flow Logs for traffic from the instance to unusual destinations.

Answer

Review AWS CloudTrail logs for the instance's IAM role and look for source IP addresses outside the VPC.

Answer

Use IAM Access Analyzer to review the trust policy of the instance's IAM role.

Question 4

A company has a security requirement to automatically isolate an Amazon EC2 instance that is generating high network traffic to a known malicious IP address. The company uses Amazon GuardDuty and AWS Lambda. Which combination of services and configurations should be used to achieve the isolation?

Accepted Answer

Use Amazon GuardDuty to send findings to Amazon CloudWatch Events, which triggers an AWS Lambda function that modifies the security group to remove the instance.. Amazon GuardDuty generates findings for threats like communication with known malicious IPs, and these findings can be sent to Amazon CloudWatch Events (now Amazon EventBridge). CloudWatch Events can then trigger an AWS Lambda function that modifies the security group associated with the EC2 instance to remove its inbound/outbound rules, effectively isolating the instance. This automated workflow meets the security requirement without manual intervention.

Answer

Use VPC Flow Logs to send logs to CloudWatch Logs, then create a metric filter that triggers a Lambda function.

Answer

Use Amazon GuardDuty to send findings to AWS Systems Manager Automation to run a document that isolates the instance.

Answer

Use AWS Config rules to detect the traffic and invoke a Lambda function to change the security group.

Question 5

A security engineer is investigating a potential security incident involving an Amazon RDS database. The engineer needs to determine if someone attempted to access the database with incorrect credentials. Which AWS service should the engineer use to view authentication failures?

Accepted Answer

Amazon RDS database logs (error logs). Amazon RDS database error logs capture authentication failures, including attempts with incorrect credentials, because the database engine itself logs these events. For example, MySQL's error log records 'Access denied for user' messages, and PostgreSQL's log records 'FATAL: password authentication failed' entries. This makes RDS database logs the direct source for viewing authentication failures at the database level.

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Question 6

A security engineer is setting up automated incident response for a compromised IAM user. The engineer wants to automatically revoke the user's access keys and attach a deny-all policy when a GuardDuty finding of type 'UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration' is generated. Which services should be used to achieve this automation?

Accepted Answer

Amazon CloudWatch Events and AWS Lambda. Amazon CloudWatch Events (now part of Amazon EventBridge) can capture GuardDuty findings in real-time and trigger a Lambda function to revoke IAM user access keys and attach a deny-all policy. This is the native, event-driven pattern for automated incident response to GuardDuty findings, as CloudWatch Events directly supports GuardDuty as an event source.

Answer

Amazon Simple Notification Service (SNS) and AWS Lambda

Answer

AWS Config and AWS Lambda

Answer

AWS Systems Manager Automation and AWS Lambda

Question 7

A company uses AWS CloudTrail to log all API calls. The security team wants to be alerted when an IAM user creates a new access key for another IAM user (an action that could indicate privilege escalation). What is the most effective way to detect this specific API call?

Accepted Answer

Create an Amazon CloudWatch Events rule that matches the 'iam:CreateAccessKey' API call and sends a notification to an SNS topic.. Amazon CloudWatch Events (now Amazon EventBridge) can be configured with a rule that matches the specific 'iam:CreateAccessKey' API call as it occurs. When this API call is made, CloudTrail delivers the event in near real-time to CloudWatch Events, which can then trigger an SNS topic to send an alert. This provides immediate, event-driven detection without the latency of scheduled queries or the overhead of custom rules.

Answer

Query AWS CloudTrail logs using Amazon Athena on a schedule.

Answer

Use AWS Config to create a custom rule that checks for changes to IAM users.

Answer

Enable Amazon GuardDuty and look for the 'UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration' finding.

Question 8

Which TWO AWS services can be used to detect anomalous API activity in an AWS account? (Choose two.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty (A) is correct because it is a managed threat-detection service that continuously analyzes CloudTrail management and data events, VPC Flow Logs, and DNS logs using machine learning and threat intelligence to identify anomalous or malicious API activity in the account. AWS CloudTrail (B) is correct because it records API calls as events and, through CloudTrail Insights, automatically detects unusual operational API activity such as spikes in write or error rates by baselining normal behavior. VPC Flow Logs (C) capture IP traffic metadata for network interfaces but do not analyze API calls, so they cannot detect anomalous API activity on their own. AWS Config (D) evaluates resource configuration compliance and changes, not API call behavior, so it is not a detection service for anomalous API activity. Amazon Inspector (E) scans EC2 instances, container images, and Lambda functions for software vulnerabilities and unintended network exposure, not anomalous API usage.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon Inspector

Question 9

Which THREE steps should a security engineer take to ensure that an incident response plan for an AWS environment is effective? (Choose three.)

Accepted Answer

Regularly test the incident response plan through tabletop exercises and simulations.. Regularly testing the incident response plan through tabletop exercises and simulations validates the plan's effectiveness, identifies gaps, and ensures team readiness. AWS recommends using Game Days and fault injection simulators to practice real-world scenarios without impacting production environments.

Answer

Use the AWS account root user for incident response actions to ensure full permissions.

Answer

Store all evidence in an S3 bucket with public read access for easy sharing.

Question 10

A security engineer is investigating a GuardDuty finding of type 'Backdoor:EC2/C&CActivity.B!DNS'. Which TWO actions should the engineer take as part of the initial response? (Choose two.)

Accepted Answer

Isolate the EC2 instance by modifying its security group to deny all traffic.. Isolating the EC2 instance by modifying its security group to deny all traffic is a critical containment step in incident response. This immediately stops the C2 (command and control) communication detected by GuardDuty's 'Backdoor:EC2/C&CActivity.B!DNS' finding, preventing further data exfiltration or lateral movement while preserving the instance for forensic analysis.

Answer

Enable Amazon GuardDuty in the account if not already enabled.

Answer

Immediately terminate the EC2 instance to stop the activity.

Answer

Disable termination protection on the instance to allow future termination.

Question 11

Refer to the exhibit. A security engineer runs this AWS CLI command to investigate root user logins. The output shows a successful ConsoleLogin event. What should the engineer do next to improve security?

Accepted Answer

Enable multi-factor authentication (MFA) for the root user.. Enabling multi-factor authentication (MFA) for the root user adds an extra layer of security, making it much harder for an attacker to compromise the root account even if the password is known. While AWS recommends avoiding routine use of the root user, the root account cannot be deleted; instead, securing it with MFA is a best practice. Options A and B are incorrect because root user cannot be deleted, and disabling the password alone does not prevent root user login via password recovery or other methods. Option C is incorrect because IAM Access Analyzer analyzes resource-based policies for unintended access, not root user activity; it does not generate findings for ConsoleLogin events.

Answer

Delete the root user account.

Answer

Disable the root user password and require all logins via IAM users.

Answer

Enable IAM Access Analyzer to detect and alert on root user activity.

Question 12

Refer to the exhibit. A security engineer reviews this CloudFormation template. The bucket is intended to be private. What is the security issue in the configuration?

Accepted Answer

The PublicAccessBlock configuration is missing the BlockPublicPolicy setting.. The PublicAccessBlock configuration in the template is missing the BlockPublicPolicy setting. Without BlockPublicPolicy enabled, a bucket policy that grants public read access (Effect: Allow, Principal: *, Action: s3:GetObject) can be applied to the bucket, overriding the intended private configuration. The other PublicAccessBlock settings (BlockPublicAcls, IgnorePublicAcls, RestrictPublicBuckets) do not block bucket policies; only BlockPublicPolicy does. The security issue is that the bucket policy, though present, would be blocked if BlockPublicPolicy were enabled, but since it is missing, the bucket becomes publicly accessible.

Answer

The bucket does not have versioning enabled.

Answer

The bucket policy grants public read access to the bucket, which overrides the PublicAccessBlock configuration.

Answer

The bucket policy uses an incorrect resource ARN.

Question 13

A security engineer is investigating an AWS CloudTrail log entry that shows an unauthorized API call to delete an S3 bucket. Which service should the engineer use to analyze the log data for patterns of similar malicious activity?

Accepted Answer

Amazon CloudWatch Logs Insights. Amazon CloudWatch Logs Insights is the service designed for interactively querying and analyzing log data stored in CloudWatch Logs. In this scenario, the security engineer already has a CloudTrail log entry and needs to search through the logs for patterns of similar malicious activity. CloudWatch Logs Insights allows running queries to identify such patterns. Amazon GuardDuty is a threat detection service that automatically monitors for malicious activity, but it does not provide a means for the engineer to directly analyze log data; it generates findings based on its own analysis.

Answer

AWS Config

Answer

AWS Artifact

Answer

Amazon GuardDuty

Question 14

A company uses AWS Organizations with multiple accounts. The security team needs a centralized solution to automatically initiate incident response runbooks across all accounts when a threat is detected. Which approach meets these requirements?

Accepted Answer

Use AWS Security Hub with cross-account aggregation and Amazon EventBridge to trigger AWS Systems Manager Automation runbooks.. AWS Security Hub with cross-account aggregation collects findings from all accounts into a single administrator account. Amazon EventBridge can then be configured to match specific Security Hub findings (e.g., a GuardDuty threat detection) and trigger AWS Systems Manager Automation runbooks. This provides a centralized, automated incident response mechanism across all accounts without requiring per-account Lambda functions or manual remediation.

Answer

Enable Amazon GuardDuty in all accounts and use its built-in remediation actions.

Answer

Configure AWS CloudFormation StackSets to deploy incident response stacks in all accounts.

Answer

Deploy an AWS Lambda function in each member account to respond to findings.

Question 15

A company wants to detect and alert on suspicious IAM role usage, such as a role being assumed from an unusual geographic location. Which AWS service should be used to generate the alerts?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is the correct choice because it is a threat detection service that continuously monitors for suspicious activity, including unusual IAM role usage such as a role being assumed from an anomalous geographic location. It uses machine learning, anomaly detection, and integrated threat intelligence to analyze CloudTrail management events and VPC flow logs, generating alerts (findings) for deviations from baseline behavior. This directly meets the requirement to detect and alert on suspicious role assumptions without needing to write custom rules.

Answer

AWS IAM Access Analyzer

Answer

AWS CloudTrail

Answer

Amazon CloudWatch